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Top Stories 

• Officials from 4 States announced July 2 that BP would pay $18.7 billion to resolve 
charges related to a 2010 Gulf of New Mexico oil spill that was declared an environmental 
disaster. - USA Today (See item 1) 

• More than 5,000 residents in Maryville, Tennessee were evacuated after a CSX train 
traveling from Cincinnati, Ohio to Waycross, Georgia, carrying highly flammable toxic gas 
partially derailed and caught on fire July 2. - NBC News (See item 8) 

• The Washington Navy Yard in the District of Columbia was under lockdown for over 2 
hours July 2 after authorities received reports of an active shooter. - CNN (See item 20 ) 

• New York officials reported July 1 that a new superintendent was hired at the Clinton 
Correctional Facility after an investigation put 22 prison employees on administrative leave 
following the June 6 escape of 2 convicts. - Associated Press (See item 23 ) 
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Energy Sector 

1. July 2, USA Today - (National) Gulf States reach $18.7 billion settlement with BP 
over 2010 oil spill. Officials from Florida, Alabama, Mississippi, and Louisiana 
announced July 2 that BP would pay $18.7 billion in a settlement resolving charges 
related to a 2010 Gulf of Mexico oil spill that was declared an environmental disaster. 
The funds will be used to resolve Clean Water Act penalties, natural resources damage 
claims, economic claims, and economic damage claims for local governments. 

Source: http://www.usatodav.com/storv/monev/business/2015/07/02/gulf-states-reach- 
1 87b-settlement— bp-over-oil-spill/296 11451/ 

2. July 2, International Business Times - (National) Fracking in U.S. is consuming a lot 
more water than it used to. Findings from a recently released U.S. Geological Survey 
study of water used in hydraulic fracturing operations revealed that U.S. oil and natural 
gas fracking is consuming over 28 times the water it did 15 years ago, and that amounts 
vary widely nationwide, among other findings. 

Source: http://www.ibtimes.com/fracking-us-consuming-lot-rnore-water-it-used- 
1993514 

3. July 2, Associated Press - (Nebraska) Seven hurt in explosion at West Point Sapp 
Bros. Officials reported that a July 2 explosion and fire at Sapp Bros. Petroleum in 
West Point, Nebraska critically injured two workers and hospitalized five others. The 
cause of the explosion is under investigation. 

Source: http://iournalstar.com/news/local/911/seven-hurt-in-explosion-at-west-point- 
sapp-bros/article 867a9815-bel8-543f-9c3c-0alc2982c6bc.html 

4. June 30, WIAT 42 Birmingham - (Alabama) Alabama Power working to restore 
outages in Birmingham metro area. Alabama Power officials reported June 30 that 
they restored service to 27,700 of the 31,600 customers who lost power after severe 
storms moved through the area that morning. 

Source: http://wiat.com/2015/06/30/alabama-power-working-to-restore-outages-in- 
birmingham-metro-area/ 

For another story, see item 32 
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Chemical Industry Sector 

See item 32 
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Nuclear Reactors, Materials, and Waste Sector 

5. July 1, USA Today - (New York) Faulty insulation caused fire, oil spill at N.Y. 
nuclear plant. Entergy officials reported June 30 that the cause of a May 9 fire at the 
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Indian Point Energy Center in Buchanan was an insulation failure that triggered a short 
circuit in a transformer’s high-voltage coil. Crews have recovered about 8,300 of the 
24,300 gallons of dielectric fluid that leaked during the incident, and 6 shoreline 
locations required environmental cleaning that was completed June 5. 

Source: http://www.usatodav.com/storv/news/nation/2015/07/01/indian-point-nuclear- 
plant-fire-cause/29558387/ 

For another story, see item 32 
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Critical Manufacturing Sector 

See item 32 
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Defense Industrial Base Sector 

See item 20 
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Financial Services Sector 

6. July 1, U.S. Securities and Exchange Commission - (Pennsylvania) SEC charges 
former stockbroker with conducting Ponzi scheme. The U.S. Securities and 
Exchange Commission charged a former stockbroker in Pennsylvania July 1 with 
conducting a Ponzi scheme in which he allegedly raised $15.5 million from over 50 
investors by selling fraudulent certificates of deposit (CDs) to customers while 
promising higher-than-normal interest rates of return, before spending invested funds 
on himself or to repay earlier investors. 

Source: http://www.sec.gov/news/pressrelease/2015-135.html 

7. July 1, Jackson Clarion-Ledger - (Mississippi) North Miss, bank robbery suspect 
had gun, pipe bomb. Saltillo, Mississippi Police Department officials reported July 1 
that they arrested a man suspected of robbing a First American National Bank with a 
firearm and a pipe bomb. A local bomb squad responded and closed the area 
surrounding the bank. 

Source: http://www.clarionledger.com/story/news/2015/07/01/saltillo-bank- 
robbery/29560335/ 

For additional stories, see items 28 and 31 
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Transportation Systems Sector 



8. July 2, NBC News - (Tennessee) Tennessee train derailment: 5,000 residents 
evacuated from Maryville. More than 5,000 residents in Maryville, Tennessee were 
evacuated after a CSX train traveling from Cincinnati, Ohio, to Waycross, Georgia, 
carrying highly flammable and toxic gas, partly derailed and caught fire July 2. The 
evacuation zone is a 2-mile radius and could be in place for up to 48 hours. 

Source: http://www.nbcnews.com/news/us-news/tennessee-train-derailment-5-000- 
residents-evacuated-maryville-n385576 

9. July 2, WWLP 22 Springfield - (Massachusetts) Traffic reopens on 1-91 north after 
overnight repairs. All lanes of Interstate 91 in downtown Springfield will reopen July 
2 after being closed Julyl due to emergency repairs. 

Source: http://wwlp.com/2015/07/01/emergencv-repairs-on-i-91-north-weds-night-2- 
lanes-to-close/ 

10. July 2, KSLA 12 Shreveport - (Louisiana) Motorcycle crash shuts down part of 1-20. 
Interstate 20 in Bossier City was shut down for approximately 2 hours July 2 while 
crews cleared the scene of a motorcycle accident. No other vehicles were involved in 
the crash and the driver had minor injuries. 

Source: http://www.ksla.com/storv/29459606/motorcycle-crash-shuts-down-part-of-i- 
20 

11. July 1, WGAL 8 Lancaster - (Pennsylvania) 1-83 reopens after truck crash. The 
southbound lanes of Interstate 83 at mile marker 9.5 in York County reopened July 1 
after being closed for 4 hours while crews towed a semi-truck that was involved in an 
accident. No injuries reported. 

Source: http://www.wgal.com/news/portion-of-i83-to-be-shut-down-at-9-am/33900518 

12. July 1, WOOD 8 Grand Rapids - (Michigan) 1 killed, 6 hurt in crash involving 
ambulance. Michigan Highway 37 north of 15 Mile Road NE in Sparta Township was 
closed for several hours July 1 due to a 3-vehicle accident that involved a Life EMS 
ambulance that killed 1 person and injured 6 others. 

Source: http://woodtv.corn/2015/07/01/multiple-iniuries-reported-after-ambulance- 
crash/ 

13. July 1, WMC 5 Memphis - (Mississippi) Overturned 18-wheeler creates HAZMAT 
situation, shuts down Highway 78. Highway 78 in Olive Branch was shut down for 
more than 7 hours July 1 while HAZMAT crews cleaned the area after a semi-truck 
hauling thousands of pounds of acid-filled batteries, as well as sodium hydroxide and 
hydrosulfide, overturned. The cause of the crash remains unknown. 

Source: http://www.wmcactionnews5.com/storv/29449889/traffic-stopped-on-highwav- 
78-near-red-banks 



For another story, see item 32 
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Food and Agriculture Sector 

14. July 2, U.S. Department of Agriculture - (Minnesota) FSIS issues public health alert 
for frozen raw stuffed chicken products due to possible Salmonella contamination. 
The Food Safety and Inspection Service issued a public health alert July 1 due to 
illnesses caused by Salmonella that may be associated with raw, frozen, breaded and 
pre-browned, stuffed chicken products in the State of Minnesota. The items may be 
labeled as “chicken cordon bleu” or “chicken Kiev.” 

Source: 

http://www.fsis.usda.gOv/wps/portal/fsis/home/lut/p/al/04 Si9CPykssy0xPLMnMz0v 

MAfGizOINAg3MDC2dDbwsfDxdDDz9AtvMgnvMDf3dDIAKIkEKcABHAOL6w 

WiUJX4Wxq6AZWEBfp7OzsbWPgZwxTgtqIgN8Ig01FREOBCfym8/?ldmv&page= 

gov.usda.fsis.intemet.topics&urile=wcm%3Apath%3A%2FFSIS- 

Content%2Finternet%2Fmain%2Fnewsroom%2Fnews-releases-statements-and- 

transcripts%2Fnews-release-archives-by-vear%2Farchive%2F2015%2Fpha-070115 

15. July 1, U.S. Food and Drug Administration - (National) Natural Grocers issues recall 
on lOoz. Caribbean Nut & Fruit Mix due to possible health risk. Vitamin Cottage 
Natural Food Markets Inc., a Lakewood, Colorado based grocery chain, is recalling one 
lot of Natural Grocers brand, 10 ounce Caribbean Nut & Fruit Mix as the product may 
contain salmonella in its macadamia nuts. The products were shipped to stores 
nationwide. 

Source: http://www.fda.gov/Safety/Recalls/ucm453516.htm 
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Water and Wastewater Systems Sector 

16. July 2, WUSA 9 Washington, D.C. - (Maryland) Roadwork continues after Wheaton 
water main break. A 16-inch pipe that burst July 1 and spilled 2.5 million gallons of 
water in the Wheaton area and closed down southbound Georgia Avenue was fixed 
July 2. Several homes were affected by the flooding and crews are working to repair 
the roadway. 

Source: http://www.wusa9.com/storv/news/local/2015/07/01/wheaton-water-main- 
break/29568577/ 



For additional stories, see items 1, 2, 5, and 32 
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Healthcare and Public Health Sector 

17. July 2, Albuquerque Journal - (New Mexico) ‘Holistic’ cardiologist in Santa Fe 
accused of fraud. A self-described “holistic” cardiologist in Santa Fe, New Mexico 
was charged July 1 for allegedly submitting fraudulent claims to health care programs 
including Medicare from 2010-2011, photocopying patient records to fabricate new 
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ones, performing and billing for unnecessary tests, and inserting false systems and 
diagnoses, among other allegations. 

Source: http://www.abqiournal.com/606954/news/holistic-doctor-accused-of- 
fraud.html 



For another story, see item 12 
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Government Facilities Sector 

18. July 2, Help Net Security- (Massachusetts) Harvard University suffers IT security 
breach. Harvard University announced July 1 that 8 of its schools and administrative 
organizations were affected by a data breach discovered June 19. Federal law 
enforcement is working with the school to conduct a forensic investigation. 

Source: http://www.net-securitv.org/secworld.php?id= 18586 

19. July 1 , Bloomsburg Press Enterprise - (California) Moreno Valley: 175-acre fire 
prompts Uake Perris campground evacuation. Riverside County Fire Department 
officials reported July 1 that a wildfire, dubbed Merwin, prompted a response from 244 
firefighters, 2 bulldozers, and the evacuation of Lake Perris State Recreational Area. 

No injuries were reported. 

Source: http://www.pe.com/articles/lake-772207-perris-fire.html 
For additional stories, see items 20 and 27 
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Emergency Services Sector 

20. July 2, CNN - (Washington, D.C.) Washington Navy Yard: police say ‘all clear’ 
after lockdown. The Washington Navy Yard was under lockdown for over 2 hours 
July 2 after authorities received reports of an active shooter in building 197 that 
prompted the evacuation of employees and sent dozens of police crews and ambulances 
to respond to the incident. Authorities cleared the building and found no shooter. 
Source: http://www.cnn.com/2015/07/02/politics/navv-yard-shooting-lockdown-police- 
activity/index.html 

21. July 2, IDG News Service - (California) DEA agent pleads guilty to accepting Silk 
Road funds. A U.S. Drug Enforcement Administration agent pleaded guilty July 1 to 
charges alleging that he accepted $297,000 in bitcoins and routed the money to his own 
account while on the Silk Road investigation. 

Source: http://www.csoonline.com/article/2943716/malware-cybercrime/dea-agent- 
pleads-guilty-to-accepting-silk-road-funds.html 

22. July 1, Greenfield Recorder - (Massachusetts) Police say hoax prompted big 
response to Greenfield hotel. Greenfield, Massachusetts authorities reported July 1 
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that another “swatting” incident occurred after police received two hoax shooting and 
hostage calls at a Days Inn, prompting SWAT team crews and police officers to 
respond. Officials are investigating all hoax calls and plan to prosecute all culprits. 
Source: http://www.recorder.com/home/17574957-95/police-say-hoax-prompted-big- 
response-to- greenfield-hotel 

23. July 1, Associated Press - (New York) New warden, security measures at upstate 
NY prison where murderers escaped. New York officials reported July 1 that a new 
superintendent was hired at the Clinton Correctional Facility to increase and implement 
new security measures after an internal investigation put 22 prison employees on 
administrative leave following the escape of 2 murder convicts June 6. 

Source: http://7online.com/news/new-warden-securitv-measures-at-upstate-ny-prison- 
where-murderers-escaped/809257/ 

24. July 1, Bloomsburg Press Enterprise - (California) Lake fire: police impostor now 
accused of impersonating firefighter. California police reported July 1 that a man 
from San Bernardino was charged for allegedly impersonating a firefighter, stealing a 
pohce vehicle, possessing firearms while a felon, and stealing property June 27. 

Source: http://www.pe.com/articles/bear-772008-big-lake.html 

25. July 1, Fort Smith Southwest Times Record - (Arkansas) Video: cuffed Ark. Woman 
steals, crashes cruiser. A Greenwood woman was charged July 1 for property theft, 
third-degree escape, second-degree battery, disorderly conduct, and DWI/DUI offenses, 
among other charges, after allegedly escaping police custody, stealing a police car, and 
crashing the vehicle into a gas main June 30. 

Source: http://www.policeone.com/police-products/vehicle-equipment/prisoner- 
transport/articles/8636092-Video-Cuffed-Ark-woman-steals-crashes-cruiser 

For another story, see item 8 
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Information Technology Sector 

26. July 2, Threatpost - (International) Cisco UCDM platform ships with default, static 
password. Cisco warned customers that its Unified Communications Domain Manager 
Platform software versions prior to 4.4.5 have a default, static password for an account 
with root privileges, possibly allowing an unauthenticated remote attacker to take full 
control of an affected system with root privileges. 

Source: https://threatpost.com/cisco-ucdm-platform-ships-with-default-static- 
password/1 13591 

27. July 2, Softpedia - (International) GhostShell hackers reveal 548 targets, links to 
dumps. Hackers associated with GhostShell released a list of 548 compromised targets 
including government, educational, and retail sector Web sites along with links to 
previews of extracted data in an effort to reportedly draw attention to poor 
cybersecurity practices. The data contained contact information, dates of birth, and 
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hashed and plain text passwords. 

Source: http://news.softpedia.com/news/ghostshell-hackers-reveal-548-targets-links-to- 
dumps-485866.shtml 

28. July 2, Securityweek - (International) PCI Council updates Point-to-Point 
Encryption Standard. The Payment Card Industry Security Standards Council (PCI 
SSC) announced the release of Version 2.0 of its PCI Point-to-Point Encryption 
Solution Requirements and Testing Procedures, updating requirements for encryption 
products and giving merchants the option to manage their own encryption solutions for 
point-of-sale (PoS) locations, among other changes intended to enhance security and 
PCI SSC compliance. 

Source: http://www.securitvweek.com/pci-council-updates-point-point-encryption- 
standard 

29. July 1 , Threatpost - (International) LifeLock patches XSS that could’ve led to 
phishing. LifeLock patched a cross-site scripting (XSS) vulnerability on its Web site 
that could have allowed an attacker to inject HyperText Markup Language (HTML) 
into the site’s unifonn resource locator (URL) to create a fake login page to harvest 
usernames and passwords from customers. 

Source: https://threatpost.com/lifelock-patches-xss-that-couldve-led-to- 
phishing/1 13577 

30. July 1, Securityweek - (International) Flaw in 802.11n standard exposes wireless 
networks to attacks: researchers. Security researchers in Belgium discovered a 
vulnerability in the frame aggregation mechanism in the 802.1 In wireless networking 
standard in which an attacker could use a Packet-in-Packet (PIP) technique to inject 
arbitrary frames into wireless networks, allowing access to internal services. 

Source: http://www.securityweek.com/flaw-80211n-standard-exposes-wireless- 
networks-attacks-researchers 

31. July 1, Help Net Security - (International) 4,900 new Android malware strains 
discovered every day. Security researchers from G DATA reported that they 
discovered 440,267 new Android malware strains in the first quarter of 2015, and that 
at least 50 percent of the malware currently being distributed includes banking trojans 
and SMS trojans for financial motivations, among other findings. 

Source: http://www.net-security.org/malware news.php?id=3067 

32. July 1, Softpedia - (International) Schneider Electric’s Wonderware products 
receive security patch. Schneider Electric released a patch addressing a high-severity 
security vulnerability in its InTouch, Application Server, Historian, and SuiteLink 
applications in the Wonderware System Platform in which an attacker could leverage 
dynamic link library (DLL) hijacking to run code on an affected machine. 

Source: http://news.softpedia.com/news/schneider-electric-s-wonderware-products- 
receive-security-patch-485787.shtml 

33. July 1, Threatpost - (International) Patched Apple Quicktime vulnerability details 
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disclosed. Security researchers from Cisco released details on a recently patched use- 
after-free vulnerability in Apple’s QuickTime media player in which an attacker could 
access and control data inside the internal data in a QuickTime file to remotely execute 
code on a targeted system. 

Source: https://threatpost.com/patched-apple-quicktime-vulnerabilitv-details- 
disclosed/1 13570 



For another story, see item 18 



Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 

See item 31 
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Commercial Facilities Sector 

34. July 2, Associated Press - (Michigan) Fire at demolition business sends smoke over 
Grand Rapids. Grand Rapids, Michigan authorities reported July 1 that a fire at Pitsch 
Company, a demolition and salvage business, prompted an evacuation of surrounding 
homes and caused approximately $1 million in damages. The cause of the fire is 
unknown and no injuries were reported. 

Source: http://www.9andlOnews.com/story/29459553/fire-at-demolition-business- 
sends-smoke-over-grand-rapids 

35. July 1, Associated Press - (Washington) Officials: Wenatchee blaze that destroyed 
29 homes was human-caused; fire now 83% contained. Over 29 homes and 4 
commercial business complexes in Wenatchee were destroyed after a wildfire burned 
over 4 miles of land June 28 - July 1. Officials reported 83 percent of the fire has been 
contained and no injuries were reported. 

Source: http://ql3fox.com/2015/07/01/officials-wenatchee-blaze-that-destroyed-24- 
homes-was-human-caused/ 



For additional stories, see items 8, 22, 27, and 28 
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Dams Sector 



See item 32 
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About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday through Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailyReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 

Daily Report Team at (703) 942-8590 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support@ govdelivery.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US -CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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